From a00fe32ffcd7afd53fcf130e68ca76274bdc0f79 Mon Sep 17 00:00:00 2001
From: Jeremy Daer <jeremydaer@gmail.com>
Date: Thu, 10 Sep 2026 02:47:57 -0700
Subject: [PATCH] Reference in-repo workflows with GitHub's self-repository
 syntax

zizmor 1.30.0, which zizmor-action 0.6.3 runs by default, adds a
self-repository audit that flags workspace-relative `uses: ./...` references
to in-repo actions and reusable workflows. GitHub's `uses: $/...` form resolves
against the running commit rather than the checked-out filesystem, so it can't
pick up an action cloned by an earlier step, and GitHub counts it as pinned.
This repo pins zizmor-action 0.6.2 and would fail the audit on the next bump.

actionlint 1.7.12 rejects the new form and no release knows it yet
(rhysd/actionlint#711), so an actionlint config ignores that one message for
workflow files, with a note to drop it once a release does.

Same change as basecamp/hey-sdk#171 and #174.
---
 .github/actionlint.yaml       | 9 +++++++++
 .github/workflows/release.yml | 2 +-
 2 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 .github/actionlint.yaml

diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000..e285e3f2
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,9 @@
+# actionlint's rules for this repository. See https://github.com/rhysd/actionlint/blob/main/docs/config.md
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # GitHub's self-repository `uses: $/...` syntax (July 2026) is what zizmor's
+      # self-repository audit asks for in place of `./...`, and what our reusable-workflow
+      # calls use. actionlint 1.7.12 predates it and has no release that knows it
+      # (rhysd/actionlint#711); drop this once one does.
+      - 'reusable workflow call "\$/.+" at "uses" is not following the format'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a787eb0b..efafa582 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   security:
     name: Security scan
-    uses: ./.github/workflows/security.yml
+    uses: $/.github/workflows/security.yml
     permissions:
       contents: read
       security-events: write